This really seems to me like how the docs say to use it and I can't figure out what is wrong. If I remove the argument from the new() call, it works as expected. It doesn't seem to like the "icmp" argument.

Firewall rules can block icmp requests and is very common to do so, but I would not expect it to be blocked by its own request to localhost or the loopback address. Blocking rules like this are normally meant to drop requests from remote connections, not localhost, but the rule can be configured to block all requests.

Have you tried pinging another device in the same LAN? Does that give the same error?

The default protocol used is tcp, but if you see a difference in functionality between specifying and not specifying tcp, then that could indicate a bug in the module.